no image

Notice of Privacy Practices

This notice is being provided to you in compliance with the underlying policies outlined in the Health Insurance Portability and Accountability Act (HIPAA). Grand Canyon University student medical records are subject to requirements of the Federal Educational Rights and Privacy Act of 1974 (FERPA) rather than HIPAA, as FERPA carves out an exemption for all student Records. However, in order to ensure that GCU utilizes up-to-date privacy and security protocols, we have instituted the following practices.

This notice describes how "medical/personal health information" (PHI) about you may be used and disclosed and how you can get access to this information. Please review it carefully.

Grand Canyon University understands the importance of your PHI and follows strict policies to keep your PHI private. Therefore, Grand Canyon University is providing you this notice that describes its privacy practices concerning your PHI/medical record. Your PHI means any of your written and verbal health information, including demographic data that can be used to identify you and that relates to your past, present, or future physical or mental health condition. In general, when we release your PHI, we will release only the information needed to achieve the purpose of the use or disclosure. Your PHI will be available for release to you, to a provider regarding your treatment, or due to a legal requirement.

GCU reserves the right to change the privacy practices described in this notice. Changes to our privacy practices would apply to all health information we maintain. If we change our privacy practices, a revised notice will be available upon request.


GCU does not sell your PHI to anyone or disclose your PHI to other companies who may want to sell their products to you.

GCU will obtain your written authorization to use and disclose your PHI, except for the following uses and disclosures:

  1. To You. GCU may disclose your PHI to you.
  2. For Treatment. GCU may use and disclose your PHI to health care providers and our business associates who request PHI in connection with your diagnosis, treatment, management of your care, coordination of benefits, and insurance eligibility.
  3. For Payment. GCU may use and disclose your PHI for its payment-related activities and those of health care providers and health plans.
  4. For Health Care Operations. GCU may use and disclose your PHI as necessary, for our own health care operations in order to facilitate the function of the Cooke Student Health Center and to provide quality care. We may also disclose patient information to other providers or health plans that have a relationship with you for their health care operations.
  5. When Required by Law. GCU will use and disclose your PHI if it is required to do so by any Federal, State or local law.
  6. When there are Matters in the Public Interest. GCU may be required to report your PHI to authorities to help prevent or control disease, injury or disability. This may include records pertaining to certain diseases, injuries, birth or death information, information of concern to the Food and Drug Administration, or information related to child neglect, abuse or domestic violence. GCU may also have to report to your employer certain work-related illnesses and injuries so that your workplace can be monitored for safety.
  7. To Conduct Health Oversight Activities. GCU may disclose your PHI to authorities so they can monitor, investigate, inspect, discipline, or license those who work in the health care system or for government benefit programs.
  8. In Connection with Judicial and Administrative Proceedings. GCU may disclose your PHI in the course of any judicial or administrative proceeding in response to an order of a court or administrative tribunal as expressly authorized by such order or in response to a subpoena in some circumstances.
  9. For Military, National Security, or Incarnation/Law Enforcement Custody. If you are involved with the military, national security, or intelligence activities, you are in the custody of law enforcement officials or an inmate in a correctional institution, GCU may release your PHI to the proper authorities so they may carry out their duties under the law.
  10. For Activities Related to Death. GCU may disclose your PHI to coroners, medical examiners and funeral directors so they can carry out their duties related to your death, such as identifying the body, determining cause of death, or in the case of funeral directories, to carry out funeral preparation activities.
  11. To Avoid a Serious Threat to Health or Safety. As required by law and standards of ethical conduct, GCU may release your PHI to the proper authorities if we believe, in good faith, that such release is necessary to prevent or minimize a serious and approaching threat to you or the public's health or safety.
  12. For Workers' Compensation. GCU may disclose your PHI to comply with worker's compensation laws or similar programs.
  13. To Those Involved with Your Care or Payment of your Care. GCU may choose to disclose your PHI to your family member or a close personal friend if it is directly relevant to the person's involvement in your care. GCU can also disclose your PHI in connection with trying to locate or notify family members or others involved in your care concerning your location, condition or death. You have the right to object to such disclosure.
  14. Written Authorization. Other than as stated above, GCU will not disclose your health information other than with your written authorization. You may revoke your authorization in writing at any time except to the extent that GCU has taken action in reliance upon the authorization.


  1. Access. With certain exceptions, you may inspect and obtain a copy of your PHI. GCU reserves the right to charge a reasonable cost-based fee for copying and postage.
  2. Disclosure Accounting. You may request an accounting of certain disclosures of your PHI.
  3. Restriction Requests. You may request that GCU place restrictions on the way we use or disclose your PHI for treatment, payment or health care operations. GCU is not required to agree to these additional restrictions; but if we do, we will abide by them (except as needed for emergency treatment or as required by law) unless we notify you that we are unable to agree to a requested restriction.
  4. Revoking Prior Authorization. You may revoke your authorization, except to the extent that GCU has taken action upon it.
  5. Amendment. You have the right to request an amendment of your PHI from a medical provider. If GCU denies your request, GCU will provide you with a written explanation.
  6. Confidential Communication of PHI. You have the right to ask that we communicate your PHI to you in certain ways. GCU will accommodate reasonable requests.


Should you need more information about our privacy practices, or a written copy of this notice, please contact:

Grand Canyon University
Attn: Director of Canyon Health and Wellness Center
3300 W. Camelback Road
Phoenix, AZ 85017
Phone: 602-639-6215

For your convenience, you may also download a copy of this Notice of Privacy Practices.

This Notice is effective April 14, 2003.
Revised: June 9, 2006